The readme file states: "The module will respect your access permissions, so make sure you are logged in." Does this mean that it is _necessary_ to be logged in?
If I set node creation to allowed anonymous users, and verify that they have access to /node/add/page
then I would expect an anonymous user to be able to create nodes with restws as well.

This doesn't work however as
$resource->access($op, $id)
from line 120 in restws.module:
if (user_access('access resource ' . $resource_name) && $resource->access($op, $id)) {
returns false

CommentFileSizeAuthor
#2 1196614-restws-readme-permissions.patch943 bytesklausi

Comments

Letharion’s picture

Letharion commented

FWIW, if I comment out the test that returns false, the node is successfully created.

klausi’s picture

klausi
he/him||they/them
Primary language German
Location 🇦🇹 Vienna
commented
Title: Access settings not respected for anonymous users? » Improve permissions documentation
Component: Code » Documentation
Status: Active » Needs review
StatusFileSize
new 1196614-restws-readme-permissions.patch943 bytes

No, you don't have to be logged in, the permissions can also be assigned to anonymous users. For security reasons we have introduced an extra permission to access resources via RESTWS, so you have to enable that for anonymous users, too.

Maybe the README needs an update? Patch attached

klausi’s picture

klausi
he/him||they/them
Primary language German
Location 🇦🇹 Vienna
commented
Status: Needs review » Fixed

Committed: http://drupalcode.org/project/restws.git/commit/b876662

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.